---
title: "POST /v1/auth/login/2fa — complete a pending login challenge with TOTP or recovery code."
method: POST
path: "/v1/auth/login/2fa"
tags: ["auth"]
---

# POST /v1/auth/login/2fa — complete a pending login challenge with TOTP or recovery code.

`POST /v1/auth/login/2fa`

## Request body

- LoginTwoFactorRequest — POST /v1/auth/login/2fa
  - `challenge_token` string, required
  - `code` string, nullable
  - `recovery_code` string, nullable

## Response `200`

Login completed

- AuthResponse — Successful auth response (login, register, refresh).
  - `access_token` string, required
  - `expires_in` integer, required — Access token TTL in seconds.
  - `refresh_token` string, required

## Other responses

- `400` — Invalid challenge or code
- `401` — Invalid credentials

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)